Background: Incident Management is concerned with restoring service as quickly as possible. Problem Management is concerned with determining and eliminating root cause (and hence eliminating repeat problems).

So from an Incident Management perspective the best decision is to, for example, reboot a server to restore the service. This is not ideal from a Problem Management perspective as the reboot may destroy any diagnostics and so prevent progress towards identifying root cause.

Possible Solution: Form a plan of attack for the next occurrence of the problem:

• What diagnostics to collect

• How long to allow for diagnostics before service is restored

• Prepare the necessary resources (people, process, and technology) prior to the incident

• Communicate the plan to the stakeholders